May I suggest Ansible or whatever other provisioning tool, you can subtract 9+ minutes from the title...
please don't.. provision once and snapshot, and deploy the snapshot
My First 10 Minutes on a Server
241–250 of 298 posts
Re: My First 10 Minutes on a Server
#242Earlier quoted context omitted.
I don't know enough about server security to critique most of that guide, but the Password Security section is clearly behind the times: > Passwords should always be hashed using a strong, one-way hash algorithm. [...] hashed with an algorithm like SHA-256 7 times. If they had simply written "just use bcrypt" they'd be much closer to 2016-era security practices.
BCrypt works fine, but I wouldn't say it is "2016-era security practices". It was written in 1999 and hasn't had as much scrutiny as SHA or Blowfish (although it is based on Blowfish). Regardless, using a salted, multi-pass algorithm will keep everything nicely secured using nearly any hashing algorithm. Remember the goal is not to crack one user's password using a brute force lookup table, it is to crack everyone's…
BCrypt is apparently just fine in 2016: https://news.ycombinator.com/item?id=11120528.
Re: My First 10 Minutes on a Server
#243Nice guide, better comments, leaving this here for later reference.
Re: My First 10 Minutes on a Server
#244What was wrong with 5 minutes? :-)
Re: My First 10 Minutes on a Server
#245Earlier quoted context omitted.
That is one valid way of solving this problem. Another option is to have a permission system that allows you specify that the server can only append new data, but not delete or overwrite existing files. This is useful if you don't want the added complexity of having a separate "backup management" service, which could easily become a bottleneck if you are backing up a lot of data from multiple servers. One way to do t…
Not an expert here, but this seems to me to be stripping away one layer of security. Kind of like saying that you can leave a key to your house lying around as long as the pantry door is locked - if your database server gets owned, they now have some kind of login to your backup server as opposed to no kind of login. Maybe the extra layer doesn't add much security, but if it's a simple config change and it does add s…
Not a bad point - it's a trade-off.
You could make a similar point about the centralized backup management server - it needs to have "some kind of login" to all your production database server, so of that host is compromised (which might only store encrypted copies of your backup), so are all your database servers if those privileges can be escalated. You could argue that one backup host is easier to secure than a complex system such as AWS, but then I would argue that it would probably be hard to beat the track record of S3/IAM. ;-)
Both approaches have their place. If you're dealing with a large number of hosts and a lot of data, the backup host will quickly become a bottleneck and you're probably better off with the append-only approach. If that's not a concern for you (i.e. you're not running into any bandwidth limits on the backup hosts) and want to deal with operating yet another service to avoid the risk of e.g. IAM privilege escalation, the other solution might be a better fit.
Re: My First 10 Minutes on a Server
#246One of the suggestions is to make sure your public key has the .pub extension, and they imply that if someone didn't include the extension they would be reprimanded - any reason for this in particular?
Having a reliable convention like that reduces the risk of someone accidentally copying their private key to a server.
Re: My First 10 Minutes on a Server
#247I'd be more curious to see a "My first 10 minutes on an Ubuntu desktop" version of the article.
Re: My First 10 Minutes on a Server
#248I'd be more curious to see a "My first 10 minutes on an Ubuntu desktop" version of the article.
Or alternatively: "My first 10 minutes on an Ubuntu desktop (for users who don't hate Unity, which includes myself)". In my case: Change the Switch workspace keys from Ctrl+Alt+Arrow keys to Super+ Arrow keys. Remove LibreOffice, install WPS Office. Remove Transmission, install Deluge. Install indicator-multiload, indicator-sound-switcher. Install Kodi. Install Steam. A lot more stuff, but I have not written it down.…
First time I hear about wps office, why do you prefer it over libreoffice? mobile support?
Re: My First 10 Minutes on a Server
#249Anyone remember Bastille Linux? https://help.ubuntu.com/community/BastilleLinux
Re: My First 10 Minutes on a Server
#250This one is pretty decent but if you want the ultimate guide check out this one: https://www.inversoft.com/guides/2016-guide-to-user-data-sec... It covers 10x what all the other guides cover in terms of server and application security. It was posted a few weeks ago on HN but didn't make the front-page.
Great guide!